SubjectTypeConverter Class

Implements the OIDC Core Section 8 subject types. A public client's subject passes through unchanged. A pairwise client's subject is sealed into a per-sector pseudonym that is stable (the same user and sector always map to the same value), opaque and unlinkable to outsiders, yet reversible by this server - so the real subject rides inside the pseudonym itself and no separate protected claim is needed. The seal is a deterministic (SIV-style) authenticated encryption keyed by the pairwise salt and bound to the sector as associated data, so different sectors seal the same user to unlinkable values and a pseudonym cannot be opened under the wrong sector.

public class SubjectTypeConverter : Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter

Inheritance System.Object → SubjectTypeConverter

Implements ISubjectTypeConverter

Constructors

SubjectTypeConverter(PairwiseSubjectSettings) Constructor

Creates the converter. When settings is present, its salt keys the reversible pairwise seal and its hash selects the pseudorandom function; when absent, only public subjects are supported and a pairwise request fails loud.

public SubjectTypeConverter(Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings? settings=null);

Parameters

settings PairwiseSubjectSettings

The pairwise salt and hash, or null when pairwise identifiers are not configured.

Properties

SubjectTypeConverter.SubjectTypesSupported Property

The two OIDC Core Section 8 subject types this converter implements: public (passes the local subject through unchanged) and pairwise (a reversible, per-sector sealed identifier).

public System.Collections.Generic.IEnumerable<string> SubjectTypesSupported { get; }

Implements SubjectTypesSupported

Property Value

System.Collections.Generic.IEnumerable<System.String>

Methods

SubjectTypeConverter.Convert(string, ClientInfo) Method

Converts the real subject into the client-facing subject: for a pairwise client, the reversible per-sector pseudonym; for a public client, the subject unchanged.

public string Convert(string subject, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo);

Parameters

subject System.String

clientInfo ClientInfo

Implements Convert(string, ClientInfo)

Returns

System.String

SubjectTypeConverter.ConvertBack(string, ClientInfo) Method

Recovers the real subject from the client-facing subject: for a pairwise client, opens the per-sector pseudonym; for a public client, returns the subject unchanged. Returns null when a pairwise pseudonym cannot be opened, so the caller can surface a protocol-level rejection instead of faulting.

public string? ConvertBack(string subject, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo);

Parameters

subject System.String

clientInfo ClientInfo

Implements ConvertBack(string, ClientInfo)

Returns

System.String